Privacy Policy

Who operates this service

Bonus Vault is operated by the Bonus Vault administrator. This policy explains the information handled when you register, earn points, claim rewards, or use the website.

Information collected

• Your email address and a securely hashed version of your password.
• Your point balance, point ledger, referral relationships, campaigns redeemed, and rewards claimed.
• Registration date, last-login date, account status, and password-reset records.
• A keyed, irreversible network identifier derived from the signup IP address, referral risk flags, and review decisions used to prevent abuse. Raw IP addresses are not intentionally stored in the store data or audit log.
• Session, rate-limit, audit, and administrative action information used to secure and operate the service.

How information is used

Information is used to provide accounts, prevent duplicate redemptions, maintain accurate balances, fulfil reward claims, assist with password resets, investigate abuse, secure the service, create backups, and administer the programme.

Lawful bases

Where UK data protection law applies, account and transaction information is processed because it is necessary to provide the service requested by members. Security, fraud prevention, audit, backup, and programme-administration records are processed for the operator’s legitimate interests in running a reliable rewards service. Where consent is the appropriate basis, it may be withdrawn without affecting processing that was already lawful. External newsletter providers are responsible for the consent they collect through their own forms.

Cookies and sessions

A necessary session cookie keeps you signed in and protects forms against unauthorised submissions. If you follow a member’s referral link, a signed referral cookie remembers that attribution for up to 30 days. These cookies are not used for advertising. Session records expire according to the configured security limits or when you sign out.

External offers

When you follow a newsletter or purchase offer, your browser leaves Bonus Vault and the destination provider may collect information under its own privacy policy. Bonus Vault does not automatically send your member email, password, point balance, or claim history to those external websites.

Recipients and international processing

Information may be processed by hosting, infrastructure, and technical service providers acting for the operator, and may be disclosed where required by law or reasonably necessary to protect the service and its users. If a provider processes information in another country, the operator should ensure that an appropriate legal transfer mechanism or safeguard is used where required.

Storage, backups, and retention

Account information is stored in protected flat files rather than a third-party database. Rotating backups may contain member records, uploaded images, and audit events. Information is retained while an account is active and afterward where reasonably necessary for transaction history, security, fraud prevention, recovery, or legal obligations. Deleted accounts are anonymised while historical ledger and claim records are preserved.

Security

The service uses password hashing, protected storage files, session expiry, request limits, audit logging, atomic data writes, validation, and rotating backups. No internet service can guarantee absolute security, so members should use a unique password and report suspected account misuse promptly.

Your privacy rights

Depending on the law and the processing involved, you may have rights to access, correct, erase, restrict, object to, or receive a portable copy of personal information, and to withdraw consent where consent is used. You may ask the administrator to correct your email address, provide account assistance, or delete and anonymise your account. Some historical records may remain for the purposes described above. If UK data protection law applies, you may also complain to the Information Commissioner’s Office.

The service is not intended for anyone below the minimum age required to consent to online services in their location.

Contact and changes

For privacy questions or rights requests, contact the store administrator using the support details through which you were invited or registered.

This policy may be updated as the service changes. The effective date above identifies the current version.